Unable to use Nitrokey HSM with Windows Server 2022

[bloxsome]

Seems to be an issue with Server 2022 and the NitroKey HSM. For some reason, it shows up as a Microsoft smart card reader (ccid) with a faulty driver. Haven't done much digging into it yet.

[jans23]

It sounds like you didn't install OpenSC's Minidriver.

[bloxsome]

It sounds like you didn't install OpenSC's Minidriver.

I thought the same thing yet I followed the same install process on a SR 2019 box and had no issues.

[dengert]

How does Server 2022 compare to other versions? Does the Nitrokey HSM work on Windows 10 and Windows 11 I.e. does OpenSC need to be signed to do install? Did it install? Are you able to use any commands like pkks11-tool --test --login. Or pkcs11-tool -M Or certutil -scinfo Are you trying to use EC keys?

…

On Sat, Apr 23, 2022, 6:50 AM Josh Bloxsome ***@***.***> wrote: It sounds like you didn't install OpenSC's Minidriver. I thought the same thing yet I followed the same install process on a SR 2019 box and had no issues. — Reply to this email directly, view it on GitHub <#2541 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGTIMJZ5YKYNF34AOBIIR3VGPPYHANCNFSM5T2PRG5Q> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[dengert]

Windows has a limit of ten smart card readers because of RDC problems. Does the 2022 server add additional readers?
https://docs.microsoft.com/vi-VN/troubleshoot/windows/win32/limitation-10-smart-card-readers

[bloxsome]

How does Server 2022 compare to other versions? Does the Nitrokey HSM work on Windows 10 and Windows 11 I.e. does OpenSC need to be signed to do install? Did it install? Are you able to use any commands like pkks11-tool --test --login. Or pkcs11-tool -M Or certutil -scinfo Are you trying to use EC keys?
…
On Sat, Apr 23, 2022, 6:50 AM Josh Bloxsome @.> wrote: It sounds like you didn't install OpenSC's Minidriver. I thought the same thing yet I followed the same install process on a SR 2019 box and had no issues. — Reply to this email directly, view it on GitHub <#2541 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAGTIMJZ5YKYNF34AOBIIR3VGPPYHANCNFSM5T2PRG5Q . You are receiving this because you are subscribed to this thread.Message ID: @.>

[bloxsome]

Sorry, clicked the wrong button! Didn't mean to close this and reopen it :)

How does Server 2022 compare to other versions?
Seems fairly similar yet I'm not sure what all changed under the hood. Still trying to do some digging. (Nothing from a software signing perspective)

Does the Nitrokey HSM work on Windows 10 and Windows 11
Yes, I was able to use it on my windows 11 box without any issues. Install worked without being signed and I didn't notice any prompts indicating that it had to be but I will double check.

I.e. does OpenSC need to be signed to do install? Did it install?

Are you able to use any commands like pkks11-tool --test --login. Or
pkcs11-tool -M Or certutil -scinfo
On windows 11, I was able to use the tools yet on Windows 2022 it wouldn't find the NitroKey HSM only this fault SmartCard Reader driver.

Are you trying to use EC keys?
Yes, I was trying to yet just any key generation would of been nice.

On the additional reader front, I'm still looking into that as well.

[dengert]

it shows up as a Microsoft smart card reader (ccid) with a faulty driver. Haven't done much digging into it yet.

What do you mean by the above? Most readers use the Microsoft default CCID reader driver. Can you be more specific on what device driver show for the driver? Is there am error code?

I only have Windows 10 Pro. With a Nitro Start, device manager shows: "Microsoft Uscccid Smartcard Reader (WUDF)" 6/21/2006, version "10.0.19041.1"

Is this the problem?
https://docs.microsoft.com/en-us/troubleshoot/windows-client/windows-security/code-31-device-manager-usbccid-smartcard-reader-problem

[bloxsome]

Sorry, just getting the server back up and running. Yes, it is receiving an error code 31 and I have tried the solution outlined in that article without any resolution.

Microsoft Usbccid Smartcard Reader (UMDF2) Code 31 - Operation Failed

[jans23]

For testing purposes and to nail down issues I recommend to use RSA2048 and not EC. If everything works, change the algorithm back to EC in a last step.

[dengert]

Did you restart server after making registry change? Note registry change is at the: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\Readers level, so it applies to all readers.

Have you tried telling Device Manager to update the driver?

Google for: Microsoft Usbccid Code 31
There are a number suggestions that appear to say update the registry or restart/update/rollback the driver.
All are Microsoft issues. I assume Windows 2022 cam out this year, so this may be a new problem, as all the "fixes" are dated in 2021 or older.

[bloxsome]

Yes, I restarted the server and applied it in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\Readers level. Along with that, I have tried updating the driver, removing it and re-installing it, etc. Yes, I think we will need to wait for a new fix. Thank you for the guidance :)

[StefanD986]

I think I may have a solution for you: Windows seems to select the wrong device driver on Windows Server. On Windows Server the device shows up as "Microsoft Usbccid Smartcard Reader (UMDF2)", whereas on a desktop windows it shows up as "Microsoft Usbccid Smartcard Reader (WUDF)"

I do not know why this happens, but the following worked for me:

1. Open Device Manager
2. Right click the smart card reader device that shows a problem -> Update Driver
3. Browse my computer for drivers
4. Let me pick from a list of available drivers on my computer
5. Select Microsoft Usbccid Smartcard Reader (WUDF) instead of the UMDF2 version.
6. Click next to complete the driver change

What is a bit annoying about this is if you plug in the device on a different USB port, then you have to do the same again.

So if anybody knows how to make this permanent I'd be very happy to hear about it. It probably involves modifying the inf files a bit?

• For the broken UMDF2 driver it uses this inf file: C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_d3361c9b119e0de8
• For the working WUDF driver it uses C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a32870cf151b98c5

(the hash parts of the file name might differ a bit depending on the windows version)

[bloxsome]

Interesting, Thanks @StefanD986! Sorry, has been a while since I have had a chance to dig into this. Let me see how that goes.

[vonangelo]

@StefanD986 You're a lifesaver - thanks!